CMMC
Level 1 & 2 · NIST SP 800-171
For defense contractors handling FCI or CUI. SPRS score, SSP and POA&M ready.
Certification by a C3PAO
Service 04 · Security Assessments
Know where you stand before the assessor does.
Readiness assessments for CMMC, FedRAMP, NIST, SOC 2, ISO 27001 and AI security. You leave with a scored gap analysis and a roadmap to close it.
- CMMC
- FedRAMP
- NIST
- SOC 2
- ISO 27001
- AI Security
Frameworks
Six assessments. One method.
Pick the one your contract, customer or board requires. We assess against it and map overlaps to the others.
FedRAMP
Low & Moderate · NIST SP 800-53
For cloud providers selling to federal agencies. Boundary, baseline and documentation gaps.
Assessment by a 3PAO
NIST
CSF 2.0 · SP 800-171 · SP 800-53
A recognized baseline for any organization. Maturity scored across all six CSF functions.
Used for board and customer assurance
SOC 2
Type I & II · Trust Services Criteria
For SaaS and service companies whose customers ask for a report. Controls and evidence gaps.
Audit by a licensed CPA firm
ISO 27001
ISO/IEC 27001:2022 · Annex A
For companies selling internationally. ISMS clauses and all 93 Annex A controls reviewed.
Certification by an accredited registrar
AI Security
NIST AI RMF · ISO/IEC 42001 · OWASP LLM Top 10
For teams already using AI tools, copilots or agents. Shadow AI, data exposure, access and guardrails reviewed.
ISO/IEC 42001 certification by an accredited registrar
Scope
We find the gaps. You decide how to close them.
The first engagement is an assessment, not a remediation project. Fixes are scoped separately once the roadmap is agreed.
✓In the initial scope
- Assess the environment. Interviews, configuration review and evidence collection.
- Identify the gaps. Every control scored met, not met or not applicable.
- Build a POA&M if needed. Plan of Action and Milestones, with owners and dates.
- Prepare you for certification. A roadmap to the audit your contract or customer requires.
×Not in the initial scope
- Applying the control fixes. Quoted separately, or handled by your team or MSP.
- The certification itself. Issued by a C3PAO, 3PAO, CPA firm or registrar.
- 01ScopeBoundary set, fixed price agreed
- 02AssessInterviews and evidence review
- 03ScoreEach control rated and risk-ranked
- 04PlanRoadmap and POA&M drafted
- 05ReadoutWalkthrough with leadership
What you receive
Four documents. Yours to keep.
Here is what they look like, using a fictional 140-person manufacturer preparing for CMMC Level 2.
Executive scorecard Sample
Ridgeline Precision (fictional) · NIST SP 800-171 Rev. 2
78 met32 not metSPRS estimate: 18
Gap analysis Sample
110 requirements · 5 shown
| Req. | Requirement | Risk |
|---|---|---|
| 3.5.3 | MFA for privileged and network access | High |
| 3.13.11 | FIPS-validated cryptography for CUI | High |
| 3.3.1 | Create and retain audit logs | High |
| 3.11.2 | Scan for vulnerabilities | Medium |
| 3.2.1 | Security awareness training | Low |
Remediation roadmap Sample
Phased by risk · six months
PhaseM1M2M3M4M5M6
P0 Quick wins
P1 Identity & crypto
P2 Logging
P3 Policy & training
P4 Readiness review
Plan of Action & Milestones Sample
Owners, milestones and target dates
| Item | Milestone | Due | Status |
|---|---|---|---|
| POA-04 | Session lock enforced on shop-floor PCs (3.1.10) | Jan 15 | Open |
| POA-07 | FIPS-validated encryption on file share (3.13.11) | Feb 28 | In progress |
| POA-09 | CUI markings added to drawings (3.8.4) | Mar 31 | Open |
Samples use a fictional company and illustrative data. Your documents follow the framework you are assessed against.
Pricing
Two packages. Fixed price after scoping.
Most of our clients have 50 to 300 people. Enterprise engagements are priced on the same method at a larger scope.
Package 1
Assessment & Roadmap
One framework. Know your gaps and what to fix first.
50 to 300 people
$15,000 to $40,000
Typically 3 to 6 weeksEnterprise, 300+
$50,000 to $125,000
Typically 6 to 12 weeks- Scoping and boundary definition
- Interviews, configuration and evidence review
- Scored gap analysis, control by control
- Risk-ranked findings in plain language
- Phased remediation roadmap
- Executive readout
Package 2 · Most requested
Certification Readiness
For a contract or customer deadline. Walk into the audit prepared.
50 to 300 people
$30,000 to $70,000
Typically 6 to 10 weeksEnterprise, 300+
$100,000 to $225,000
Typically 10 to 16 weeks- Everything in Assessment & Roadmap, plus
- POA&M with owners and target dates
- SSP, policy and ISMS documentation gap review
- Evidence binder index mapped to each control
- Mock assessor interviews with your control owners
- Crosswalk to one additional framework
- Readiness check 60 days after the readout
Where you land in a range depends on headcount, locations, systems in scope and how much is already documented. FedRAMP sits at the top of each range. A short scoping call sets a fixed price before work begins.
À la carte
Need one piece?
Add these to a package or buy them on their own.
CMMC Level 1 self-assessmentAll 15 requirements, SPRS and affirmation supportfrom $4,000
POA&M developmentBuilt from your existing findingsfrom $4,000
SSP or policy setSystem Security Plan or core policies draftedfrom $7,500
Framework crosswalkMap one framework's controls to anotherfrom $6,000
Mock assessmentAssessor-style interviews and evidence walkfrom $6,500
Remediation validationRe-check fixed controls before the auditfrom $5,000
AI security & governanceNIST AI RMF and ISO/IEC 42001 reviewfrom $10,000
Board briefingResults presented to your board or ownersfrom $2,500
FAQ
Before you book.
Are you a C3PAO, 3PAO or CPA firm?
No. TheZaraAI is an advisory practice. We get you ready; certification and attestation are issued by an authorized C3PAO, an accredited 3PAO, a licensed CPA firm or an ISO registrar.
Do you fix the gaps you find?
Not in the initial scope. The assessment ends with a roadmap your team or MSP can act on. If you want help applying the fixes, we quote that separately once the roadmap is agreed.
Do we need a POA&M?
It depends on the framework and how many gaps remain. CMMC and FedRAMP use one formally; for others it is often still the clearest way to track open items. We discuss it during scoping.
Can you assess more than one framework?
Yes. Most controls overlap, so a second framework is mapped through a crosswalk instead of a second full assessment. Certification Readiness includes one crosswalk.
Who does the work?
Jax Scott: Army Cyber and Electronic Warfare Special Operations Warrant Officer, former Deputy CISO and VP of Cybersecurity at Pearson, with more than 20 years in military and enterprise security. Nothing is subcontracted.
Start with a fifteen-minute scoping call.
Tell us the framework and the deadline. We will tell you which package fits and what it will cost.